UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,027
Published in 7 days
640
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,027 vulnerabilities
  1. Medium 4.3

    CVE-2023-0225 · Samba

    A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.

    Published 3 Apr 2023 · Fixed in 4.17.7 · NVD
  2. Medium 4.3

    CVE-2023-28834 · Nextcloud

    Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.0.6, and 25.0.0 until 25.0.4, have an information disclosure vulnerability. A user was able to get the full data directory path of the Nextcloud server from an API endpoint. By itself this information…

    Published 3 Apr 2023 · Fixed in 23.0.14, 24.0.10, 25.0.4 · NVD
  3. Medium 6.1

    CVE-2022-27665 · WS_FTP Server

    Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is…

    Published 3 Apr 2023 · NVD
  4. Medium 4.9

    CVE-2023-28837 · Wagtail

    Denial-of-service via memory exhaustion when uploading large files

    Published 3 Apr 2023 · Fixed in 4.1.4, 4.2.2 · NVD, Project advisories (GitHub)
  5. Medium 5.4

    CVE-2023-28836 · Wagtail

    Stored XSS attack via ModelAdmin views

    Published 3 Apr 2023 · Fixed in 4.1.4, 4.2.2 · NVD, Project advisories (GitHub)
  6. High 8.8

    CVE-2023-1196 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Deserialization of Untrusted Data

    Published 3 Apr 2023 · Fixed in 5.12.5, 6.1.0 · NVD, WPVulnerability
  7. Medium 5.4

    CVE-2023-26283 · IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 248416.

    Published 2 Apr 2023 · NVD
  8. Medium 6.5

    CVE-2023-28844 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.10 and 25.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 31 Mar 2023 · Fixed in 24.0.10, 25.0.4 · NVD
  9. Critical 9.8

    CVE-2023-29141 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.

    Published 31 Mar 2023 · Fixed in 1.35.10, 1.38.6, 1.39.3 · NVD
  10. Medium 5.3

    CVE-2023-29140 · MediaWiki

    An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been hidden, because there is no check for rev_deleted.

    Published 31 Mar 2023 · NVD
  11. Medium 6.5

    CVE-2023-29139 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUserLog API requests in some configurations, denial of service can occur (RequestTimeoutException or upstream request timeout).

    Published 31 Mar 2023 · NVD
  12. Medium 4.3

    CVE-2023-29137 · MediaWiki

    An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for GrowthExperiments inadvertently returns the timezone preference for arbitrary users, which can be used to de-anonymize users.

    Published 31 Mar 2023 · NVD
  13. Critical 9.8

    CVE-2023-28879 · Ghostscript

    In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

    Published 31 Mar 2023 · Fixed in 10.01.0 · NVD
  14. Medium 5.3

    CVE-2023-1777 · Mattermost

    Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.

    Published 31 Mar 2023 · Fixed in 7.1.6 · NVD
  15. Medium 5.4

    CVE-2023-1776 · Mattermost

    Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.

    Published 31 Mar 2023 · Fixed in 7.1.6 · NVD
  16. Medium 6.5

    CVE-2023-1775 · Mattermost

    When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.

    Published 31 Mar 2023 · Fixed in 7.1.6 · NVD
  17. Medium 5.4

    CVE-2023-1774 · Mattermost

    When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

    Published 31 Mar 2023 · Fixed in 7.1.6 · NVD
  18. Medium 5.3

    CVE-2023-28756 · Ruby

    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

    Published 31 Mar 2023 · NVD
  19. Medium 5.5

    CVE-2023-27538 · curl

    An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the…

    Published 30 Mar 2023 · Fixed in 8.0.0 · NVD
  20. Medium 5.9

    CVE-2023-27537 · curl

    A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

    Published 30 Mar 2023 · NVD
  21. Medium 5.9

    CVE-2023-27536 · curl

    An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive…

    Published 30 Mar 2023 · NVD
  22. Medium 5.9

    CVE-2023-27535 · curl

    An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and…

    Published 30 Mar 2023 · NVD
  23. High 8.8

    CVE-2023-27534 · curl

    A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo…

    Published 30 Mar 2023 · NVD
  24. High 8.8

    CVE-2023-27533 · curl

    A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an…

    Published 30 Mar 2023 · NVD
  25. High 7.5

    CVE-2023-28835 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when the sharer did not change it the password could be guessable to an attacker willing to brute force it. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. This issue only…

    Published 30 Mar 2023 · Fixed in 23.0.14, 24.0.10, 25.0.4 · NVD
  26. High 8.8

    CVE-2023-28833 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these files by other means but this method could be exploited by tricking an admin into uploading a…

    Published 30 Mar 2023 · Fixed in 23.0.14, 24.0.10, 25.0.4 · NVD
  27. High 7.5

    CVE-2023-28644 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

    Published 30 Mar 2023 · Fixed in 25.0.3 · NVD
  28. High 8.8

    CVE-2023-28643 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with…

    Published 30 Mar 2023 · Fixed in 24.0.9, 25.0.3 · NVD
  29. High 8.8

    CVE-2023-26482 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the…

    Published 30 Mar 2023 · Fixed in 23.0.12.5, 24.0.10, 25.0.4 · NVD
  30. Medium 4.7

    CVE-2023-25000 · HashiCorp Vault

    HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

    Published 30 Mar 2023 · Fixed in 1.11.9, 1.12.5, 1.13.1 · NVD
  31. Medium 6.5

    CVE-2023-0665 · HashiCorp Vault

    HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

    Published 30 Mar 2023 · Fixed in 1.11.9, 1.12.5, 1.13.1 · NVD
  32. Medium 6.7

    CVE-2023-0620 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This…

    Published 30 Mar 2023 · Fixed in 1.11.9, 1.12.5, 1.13.1 · NVD
  33. High 7.5

    CVE-2023-0836 · HAProxy

    An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

    Published 29 Mar 2023 · Fixed in 2.2.27 · NVD
  34. High 8.1

    CVE-2022-48434 · FFmpeg

    libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).

    Published 29 Mar 2023 · Fixed in 5.1.2 · NVD
  35. Medium 5.4

    CVE-2023-1704 · Pimcore

    Cross site scripting XSS in Translation > Edit as HTML

    Published 29 Mar 2023 · Fixed in 10.5.20 · NVD, Project advisories (GitHub)
  36. Medium 5.4

    CVE-2023-1703 · Pimcore

    Cross-site Scripting (XSS) in Composite indices key field

    Published 29 Mar 2023 · Fixed in 10.5.20 · NVD, Project advisories (GitHub)
  37. Medium 5.4

    CVE-2023-1702 · Pimcore

    Cross-site Scripting (XSS) in Predefined Asset Metadata

    Published 29 Mar 2023 · Fixed in 10.5.20 · NVD, Project advisories (GitHub)
  38. Medium 5.4

    CVE-2023-1701 · Pimcore

    Cross-site Scripting (XSS) in Predefined Properties

    Published 29 Mar 2023 · Fixed in 10.5.20 · NVD, Project advisories (GitHub)
  39. High 7.8

    CVE-2023-28642 · runc

    AppArmor/SELinux bypass with symlinked /proc

    Published 29 Mar 2023 · Fixed in 1.1.5 · NVD, Project advisories (GitHub)
  40. Medium 6.3

    CVE-2023-25809 · runc

    rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared

    Published 29 Mar 2023 · Fixed in 1.1.5 · NVD, Project advisories (GitHub)
  41. Medium 6.1

    CVE-2023-28447 · Smarty

    Cross site scripting vulnerability in Javascript escaping

    Published 28 Mar 2023 · Fixed in 3.1.48, 4.3.1 · NVD, Project advisories (GitHub)
  42. Medium 5.3

    CVE-2023-0466 · OpenSSL

    The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was…

    Published 28 Mar 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  43. Medium 5.3

    CVE-2023-0465 · OpenSSL

    Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to…

    Published 28 Mar 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  44. Unrated

    WPV-5bdf526cbb79 · Elementor Pro (WordPress plugin)

    Vulnerability in Elementor Pro

    Published 28 Mar 2023 · Fixed in 3.11.7 · WPVulnerability
  45. High 8.8

    CVE-2023-3124 · Elementor Pro (WordPress plugin)

    Elementor Pro: Missing Authorization

    Published 28 Mar 2023 · Fixed in 3.11.7 · WPVulnerability
  46. High 8.1

    CVE-2023-25817 · Nextcloud

    Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.

    Published 27 Mar 2023 · Fixed in 24.0.9 · NVD
  47. Medium 4.3

    CVE-2023-22251 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authenticated attacker could leverage this vulnerability to achieve minor information disclosure.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  48. Medium 5.3

    CVE-2023-22250 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  49. Medium 4.8

    CVE-2023-22249 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  50. High 7.5

    CVE-2023-22247 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.